All Apps and Add-ons

Can you hard code a color for a value range in Calendar Heat Map?



I've got an issue where I need to display multiple years for the Calendar Heat Map however it appears to have a limit of 12 months.

That is fine I can just have a panel for each year with this search

index=`my_index` sourcetype=bluecoat_importer_queue_status section=queue_status subsection=dump 
| dedup filename
| eval _time = date_timestamp
| eval start_of_year = strptime("2017-01-01","%Y-%m-%d")
| eval end_of_year = strptime("2018-01-01","%Y-%m-%d")
| where _time > start_of_year AND _time < end_of_year
| eval status = case (queue=="splunk_completed",100,queue_status=="pending",50,queue_status=="in_progress",50,queue_status=="processing",50,1==1,0)
| table _time filename queue queue_status status 
| timechart span=1d max(status) as status
| search status=*

Note how status gets set to 0, 50 or 100. Where I plan to have

  • 0 = red
  • 50 = orange or brown
  • 100 = green

Problem is the 2017 year doesn't have any results that contain 100 so the auto colour pickers picks a different set of colours. Note green for 2017 should be brown.

alt text

Is there any way for me to hardcode these colour ranges or values so I can keep consistency between years?


Any luck with this?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>